ECR公有镜像仓库推送提示未授权问题求助

问题根源 #

你的IAM策略使用了ecr:*权限，但AWS ECR公有仓库的API动作属于**ecr-public命名空间**，而非私有仓库的ecr命名空间，权限不匹配导致推送失败。

修正后的IAM策略 #

将公有仓库对应的动作替换为ecr-public系列权限，并修正公有仓库的ARN格式（格式为arn:aws:ecr-public::账号ID:repository/仓库名）：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ecr:*"
            ],
            "Resource": "arn:aws:ecr:us-east-1:*:repository/my-app"
        },
        {
            "Effect": "Allow",
            "Action": [
                "ecr-public:GetAuthorizationToken",
                "ecr-public:BatchCheckLayerAvailability",
                "ecr-public:GetRepositoryPolicy",
                "ecr-public:DescribeRepositories",
                "ecr-public:BatchGetImage",
                "ecr-public:InitiateLayerUpload",
                "ecr-public:UploadLayerPart",
                "ecr-public:CompleteLayerUpload",
                "ecr-public:PutImage"
            ],
            "Resource": "arn:aws:ecr-public::123456789012:repository/my-app-public"
        },
        {
            "Effect": "Allow",
            "Action": [
                "ecr:GetAuthorizationToken"
            ],
            "Resource": "*"
        }
    ]
}

重要注意事项 #

• 把策略中的123456789012替换为你的实际AWS账号ID
• 生产环境建议遵循最小权限原则，只保留上述推送必需的动作，避免使用ecr-public:*全量权限
• 公有仓库的登录命令需使用ecr-public接口：

  aws ecr-public get-login-password --region us-east-1 | docker login --username AWS --password-stdin public.ecr.aws/你的仓库别名
  

• 镜像标签必须符合公有ECR格式：public.ecr.aws/你的仓库别名/my-app-public:版本标签

验证步骤 #

1. 确认IAM用户已附加修正后的策略，且无其他拒绝类策略冲突
2. 重新执行登录和推送命令，检查权限是否生效

内容的提问来源于stack exchange，提问作者Lucas